CrowdStrike Falcon vs. Huntress vs. Jamf Protect

CrowdStrike Falcon is ideal for large, cloud-native enterprises that prioritize advanced behavioral detection and have a mature SOC to manage their intelligence. However, its cloud-reliant architecture makes it a poor fit for air-gapped or offline networks. Additionally, small organizations with limited staffing may find it difficult to manage, while teams that require integrated SOAR and vulnerability management might be discouraged by the need for additional licensing to unlock those capabilities.

Incentivized

A great product that highlights any and all persistent footholds on the network and does a great job on breach monitoring. The support staff are great, efficient, and are able to reach out when there is an issue. Most problems are cleared out/mitigated before we even know about them. A great product to add to your security stack.

The main reason we went with Jamf Protect was because we wanted a dedicated macOS security endpoint. Is was easy to implement and migrate over from our previous endpoint provider. As a university we have lab macOS devices that multiple users use. So we have Jamf Protect profiles that block the use of external drives and other other profiles that allow it. We different user accounts requiring different access this can get a bit messy when deploying the config profiles at login for each user that signs in.

Incentivized

• The Log analysis is very detailed and easy to use.
• Prevent and block all type of malwares.
• Great threat intelligence which is very up-to-date with the recent cyber attacks
• very user friendly in access and management
• Automated feature of detecting, taking action and closing incidents using fusion workflow.

Incentivized

• Using the latest industry knowledge of threats that have been ongoing, but not previously known and projecting it back in time against their installed endpoints to identify machines that are vulnerable or breached and when it these events occurred
• Very quiet. If they alert, it is a thing.
• Very good at remediation.
• They communicate extremely well when it matters.
• While there are the most extensive products more often than not they are the first to alert us to a threat.

Incentivized

• Security--it scans processes for 'bad stuff'
• Notifies admins of any issues or potential issues; entirely customizable and we create many custom notifications and groups.
• Integrates with Jamf Pro
• Monitor CIS benchmarks via a clean and nice looking dashboard

Incentivized

• The Dashboard can become overwhelming at times, too much information to absorb
• Computers that may have made it out into the field without the endpoint sensor are very difficult to find
• As with all systems that rely on machine learning false positives occurr

Incentivized

• Now that they have EDR capability, they need to fully participate in MITRE testing for direct comparison against other EDR products.
• Now that they are going into Managed Antivirus and EDR with isolation capabilities they need to update their SLA comparative to other vendors
• Support for non-Windows OSes for consistency in a network
• It would be nice to seed canary files in custom shares on servers.

Incentivized

• We also have JAMF Safe internet for iPads. I would love to see this same simple idea in Jamf Protect for the iMacs

Incentivized

Crowdstrike has a large suite of tools built for helping the engineers triage and respond to security event whenever identified. The ability to customize the security policies and implement more granular policies to different devices based on the functionality is unmatched. Crowdstrike provides so much of ability in a decent budget which ascertains the value for money or ROI.

Incentivized

I think it is a complete and very trustful XDR platform, with very few False Positives. It is very well supported by highly skilled professionals on all levels: from pre-sales engineers, Customer Account Managers and support engineers.

Incentivized

We dropped SentinelOne in favor of Huntress because the UI was much more simplistic for the tier 1 techs to maintain. It beats the old web design model of three clicks to where you want to go. It is very intuitive. No one needs training to figure out how to navigate its console.

Incentivized

Jamf Protect is easy to manage. It is a separate interface from Jamf MDM which is nice for Security Operations teams. It allows Security teams to manage only the Security aspects without having to dig through all of the MDM configurations. For exception uses cases, Jamf Protect does provide options to customize settings where needed.

Incentivized

Support is generally pretty fast and gets right to the issue. We haven't had to use them much, fortunately, but the issues and questions we've had are usually answered quickly. The customer success manager/account manager you're assigned will also follow up with you on a regular cadence to ensure you're getting the most out of the subscription. There's not a whole lot of room to improve, other than the general confusion about what is/what is not covered in custom packages you're subscribed to. The initial purchase took much longer because of a package name changes and realignments of different modules into those packages.

Incentivized

There is limited amount of learning that can be completed in an in-person training available. In my opinion, the self-paced learning provided by Falcon portal is more useful over in-person training. The support from Falcon is great and useful to overcome difficulties, if any.

Incentivized

The training provided by Crowdstrike Falcon is complete in terms of the depth of technical knowledge and teaches the users about going through with the platform. There are lots of jargons for different tools that Crowdstrike Falcon has and this training teaches them all which helps in managing the platform better. Plus, the regular knowledge checks are also very helpful for the end user.

Incentivized

Read the documentation

Incentivized

I have evaluated Cortex XDR and SentinelOne Singularity alongside CrowdStrike Falcon, and while all three are capable enterprise-grade solutions, Falcon ultimately stood out due to its cloud-native architecture, broader modular coverage, and stronger identity-focused detection. Cortex XDR performs very well in environments already heavily invested in the Palo Alto ecosystem, particularly for network-to-endpoint correlation, but it introduces additional complexity and infrastructure overhead. SentinelOne excels in autonomous remediation and offline protection, especially with ransomware rollback, but is more endpoint-centric and comparatively limited in native identity and exposure-risk context. CrowdStrike Falcon provided the best overall balance by combining NGAV, EDR, identity protection, exposure management, threat intelligence, and managed hunting within a single lightweight agent and unified console, enabling better scalability, faster investigations, reduced tool sprawl, and stronger protection against modern identity-driven attacks, making it the most aligned choice for our security and operational objectives.

Incentivized

Huntress may not be a complete SOC such as Blackpoint, but the level of protection is close. Huntress provides a set of human eyes always hunting for persistent threats on your endpoints. Huntress also seems less noisy with no false positives, so no time is wasted reviewing alerts.

Incentivized

I find that all of the products have the same features; however, Jamf Protect is stronger if managing macOS devices. Also, it is one license so what you pay covers all of the features and does not require additional licenses for features like USB device control. The CIS compliance aspects generally look better in in Jamf as compared to Crowdstrike.

Incentivized

• Due to some of the difficulties with Support and Sales, we are likely looking to change to another vendor. We sometimes don't feel like customers.
• When the bluescreen incident occurred (worldwide outage) in July 2024, we were unable to contact support due to the high volume of calls at the same time. We had to figure out how to remediate it ourselves, which we did, and recovered before the vendor's official release of fixes. It shook my confidence in them.
• The product itself performed well over the last 2 years, which has kept us safe and productive. The product is good.

Incentivized

• We have been able to lower operational costs by shifting to Huntress.
• We've been able to cut costs to our clients by utilizing Huntress over competing products.
• In spite of inflation, we've been able to keep our managed service prices at a steady, below market rate, because of Huntress.

Incentivized

• Better detection of malware reducing downtime and risk to network
• Easy to implement
• Can be a bit of a steep learning curve in general

Incentivized